Boletim diário
Boletim de segurança
Carregando a edição...
Agregado automaticamente, sem curadoria humana, a partir de fontes públicas: CISA KEV, NVD, GitHub Advisories, EQSTLab e CERT-EU. Cada alerta leva à sua fonte oficial.
209 alertas neste dia, todos listados abaixo.
CVE-2026-42696
Unauthenticated Remote Code Execution (RCE) in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.19 versions.
CVE-2026-62129
Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.
CVE-2026-62024
Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.
CVE-2026-108707
Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download...
CVE-2026-81797
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.
CVE-2026-78535
Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.
CVE-2026-78533
Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.
CVE-2026-78531
Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
CVE-2026-108708
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit...
Agregado automaticamente, sem curadoria humana, a partir de fontes públicas: CISA KEV, NVD, GitHub Advisories, EQSTLab e CERT-EU. Cada alerta leva à sua fonte oficial.
CVE-2026-62021
Subscriber PHP Object Injection in Angio <= 1.1.1 versions.
CVE-2026-108550
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the...
CVE-2026-105885
Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.
CVE-2026-87780
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.
CVE-2026-83526
The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimetype function. This is due to insufficient file type validation in check_mimetype(), which writes attacker-supplied remote file content to the public uploads directory before any...
CVE-2026-77183
The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.43.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for...
CVE-2026-104766
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the `OsSettingsController::update()` handler iterating over attacker-supplied `settings` parameters without an...